Category: Euro-Atlantic

“Do Not Enter:” Using OSINT to Monitor Russia’s Wargames in the Black Sea

Russia has concentrated warships from all fleets, except the Pacific fleet, in the Black Sea for joint drills. While not unprecedented, it is rare to see such a show of…

Russia has concentrated warships from all fleets, except the Pacific fleet, in the Black Sea for joint drills. While not unprecedented, it is rare to see such a show of force.

The cross-theater deployments and large-scale exercises bear the hallmarks of a maritime build-up intended to intimidate Ukraine and deter NATO activities in the Black Sea.

This report showcases the Russian assets and maneuvers and analyzes how these actions are shaping the Black Sea theater of operations.


OBJECTIVE FEAR

Russia’s maritime build-up in the Black Sea has two aims:

  • intimidate Ukraine;
  • deter and complicate NATO activity in the Black Sea.

CROSS-THEATER DEPLOYMENTS

Russian naval task forces from the Caspian, Baltic and Northern Fleets have joined the Black Sea Fleet for exercises near Crimea.  

Caspian Flotilla: Around 15 vessels of the Capsian Flotilla, namely gunboats and landing crafts, entered the Black Sea on 16 April. 

Assets identified: 

  • 6x Project 11770 landing crafts (no. 721, 722, 723, 724, 725, 726) – NATO/AFIC reporting name: Serna-class.
  • 3x Project 1204 artillery gunboats (no. 042, 044, 045) – NATO/AFIC reporting name: Shmel-class.
  • 1x Project 16611 small hydrographic survey vessel (no. 01817).

The deployment was announced on 8 April but in a smaller number. The ships set sail on 11 April, with social media photos documenting their passage through the Don-Volga channel. Footage dated 16 and 17 April shows some of the Caspian task force vessels transiting the Kerch Strait that links the Sea of Azov with the Black Sea. 

OSINT map shows sail path of the Caspian task force (T-Intelligence 2021)

Baltic and Northern Fleets: Both fleets deployed Project 775, or Ropucha-class, landing ships to the Black Sea. Capable of carrying over 450 tones of hardware, primarily tanks or other vehicles, the Ropucha was purpose-built for beach landings. As a versatile hauling platform, the Ropucha has been Russia’s maritime logistical workhorse to deploy and support forces in Syria. 

Shispotters documented their northbound pass through the Bosphorus strait on 17 April.

Baltic Sea assets:

  • 2x Project 775 landing craft ( Kaliningrad no.102 & Korolev no.130) 

Northern Fleet assets: 

  • 2x Project 775 landing craft ( Kondopoga 027 & Alexander Otrakovsky 031) – NATO reporting name: Ropucha-class

The maritime build-up augments Russia’s land maneuvers near Ukraine’s border that have been ongoing for the past month. 

In addition to land and naval movements, Russia has also redeployed over 50 aircraft to Crimea. Ukraine estimates that Russia is now garrisoning nearly 110,000 troops near the Ukrainian border. 

MANEUVERS: COASTAL DEFENSE, AMPHIBIOUS ASSAULT

Russian forces in Crimea will hold a myriad of land, air, and naval exercises until 1 May. Some are already underway, while others will commence this week. 

The Russian drills have so far simulated the defense of Crimea and amphibious assaults of the enemy littoral – undoubtedly a message to Ukraine. Exercises involving marine and amphibious assaults are expected to continue. For example, in the next stage of a multi-phase campaign, Russian marines “will deliver artillery fire against a notional enemy’s coastal targets that will precede a seaborne assault on the shore.”

The satellite imagery below likely shows a Russian naval formation conducting a military exercise off the Crimean coast and near the Kerch Strait. Dated 19 April, the imagery was captured by the Sentinel-1’s synthetic aperture radar, a sensor that allows us to see through cloud cover.  The exercise area is covered by a notice to mariners (NOMAR) that Russia issued a few days ago. 

Sentinel-1 SAR satellite shows large and organized naval formation in a known Russian training area (T-Intelligence 2021)

The timelapse below shows the build-up of military hardware and logistics at the Opuk firing range. High-resolution imagery obtained by Der Spiegel provides a closer look at the staging ground.

Update: Monitoring the waters off Opuk, we have observed another spike in maritime activity on 21 April. The SAR imagery shows new Russian naval manoeuvres that are consistent with a coastal assault. With the exception of one search and rescue vessel (MMSI: 273145123), none of the ships were broadcasting AIS. No activity has been noticed on the previous day (April 20). 

 

New Russian maritime drills spotted on satellite imagery on 21 April (T-Intelligence)

Using visual evidence published by Zvezda TV on 22 April, we were able to confirm that these vessels and movements are connected to Russia’s exercises.

RUSSIAN NO-FLY/NO-SAIL ZONE?

As it is standard procedure, Russia issued a series of notice to airmen (NOTAMs) and notice to mariners (NOMARs) ahead of its exercises, informing seafears and pilots of which areas they should avoid. 

Map of NOTAMs and NOTMARs issued by Russia in connection to its military exercises in the Black Sea (T-Intelligence 2021)

Most “danger areas” are in effect until the end of April. However, in the Kerch strait, Russia plans to suspend the right of passage of foreign warships and “other state ships” until 31 October (purple rectangle). Russia’s state agency later claimed that “the planned restrictions will not affect navigation in the Kerch Strait or its entry points.” 

Russia’s temporary air-naval restrictions will have severe ramifications for maritime traffic to and from the Ukrainian port cities in the Azov sea, such as the strategic city of Mariupol. Russia’s de facto blockade of the Kerch strait will also prevent the Ukrainian navy, primarily based in Odessa, from reaching Mariupol in the event of a crisis.

In addition, Russia aims to deter NATO countries from even considering a “freedom of navigation” operation through the strait or a port visit on Ukrainian coast in the sea of Azov. However, the alliance has never suggested that it is considering such missions. 

DENYING NATO ISR ADVANTAGE?

Another key effect of Russia’s excessively large NOTAMs and NOMARs is that it could deter or significantly limit NATO’s ISR (Intelligence, Surveillance, and Reconnaissance) missions on Russia’s exercises.

U.S. and British reconnaissance aircraft have been intensively monitoring eastern Ukraine, Crimea, and Russia’s Black Sea for the past weeks. Drones and maritime patrol aircraft are surveilling Crimea’s coast daily up until 19 April, keeping a close watch on Russia’s build-up – read more about NATO’s ISR operations here.

Given the latest NOTAMs, NATO surveillance platforms could be targeted by Russian anti-air fire or electronic attacks. From a legal standpoint, Russia has no authority to restrict the regional airspace, as Crimea is still internationally recognized as Ukrainian territory and falls under the Kiyv flight information region (FIR). However, the Russian build-up displays a credible capability and threat. It remains to be seen if NATO ISR missions will continue, and if so, how. 

DETERRENCE TEST FOR NATO

The movement of extra-regional NATO vessels will also be indicative of whether Russia’s muscle-flexing and deterrence work. Two U.S. warships are currently on station in the Aegean Sea after President Biden abandoned plans to sail into the Black Sea, fearing that this move would provoke Russia. 

Despite Washington’s reluctance, London has instructed two Royal Navy warships, one Type 45 destroyer and one Type 23 anti-submarine frigate, to deploy to the Black Sea. It remains to be seen if London will go through with the plan in May and if the U.S. warships will continue to idle in Greek waters. 

One thing is certain, regional NATO countries and Ukraine would breathe easier knowing that advance British and American destroyers are in the Black Sea just in case Russia’s wargames turn out to be something else.  


by HARM

editing by Gecko

Update 23 April – added a new satellite image of Russian naval drills from 21 April and two explanatory paragraphs. 

Update 22 April – additional comments have been added on the paragraph about NOTAMs and NOMARs to clarify Russia’s perspective on its plans to limit navigation through the Kerch strait. 

Please follow and like us:
No Comments on “Do Not Enter:” Using OSINT to Monitor Russia’s Wargames in the Black Sea

NATO ISR Planes Monitor Russian Military Build-Up

U.S. and British reconnaissance aircraft are intensively monitoring eastern Ukraine, Crimea, and Russia’s Black Sea coast amid fears of a renewed Russian offensive. RUSSIA’S 2021 BEAR SCARE In the past…

U.S. and British reconnaissance aircraft are intensively monitoring eastern Ukraine, Crimea, and Russia’s Black Sea coast amid fears of a renewed Russian offensive.

RUSSIA’S 2021 BEAR SCARE

In the past month, Russia has moved over 14,000 soldiers and a vast array of capabilities, including Iskander ballistic missiles,  tanks, howitzers, and thermobaric rocket launchers towards the Ukrainian border. Russia then launched thousands of snap exercises countrywide and established new field camps. One staging ground in Voronezh oblast, hosting over 400 military assets, has all the hallmarks of a logistics node that could support a line of communication into Ukraine. 

OSINT map aggregating and georeferencing videos of Russian military movements near Ukraine, as documented on social media between March 27-30 (T-Intelligence)

Russia’s recent troop movements have alarmed the international community that fears a reignition of the war in eastern Ukraine or, even worse, the opening of a new front from Crimea. 

Operating from international and Ukrainian airspace, U.S. and British drones and other specialized aircraft collect updated, real-time intelligence on Russia’s nefarious activities. Given the types of aircraft visible on openly available flight trackers, the two NATO members primarily collect imagery (IMINT) and signals intelligence (SIGINT). 

IMINT ON DEMAND: RQ-4 IS OUR “FORTE”

Operated by the United States Air Force (USAF), the RQ-4 Global Hawk drone is at the forefront of Washington’s ISR (Intelligence, Surveillance, and Reconnaissance) operations in the Black Sea region. Based in Naval Air Station Sigonella (Italy), the RQ-4 Global Hawk with registration number 11-2049, either callsign FORTE10 and FORTE11, conducts frequent flights over eastern Ukraine. 

USAF RQ-4 drone at Naval Air Station Sigonella (T-Intelligence/Maxar Technologies)

Th RQ-4 Global Hawk is a long-endurance unmanned aerial vehicle (UAV), meaning it has a 24 hour+ flight autonomy. Combined with hi-resolution cameras, the RQ-4 can provide a crystal-clear, live feed of Donetsk and Luhansk’s frontlines to decision-makers and commanders back at base. As seen in the screenshots attached, the RQ-4 loiters extensively and publicly over designated areas of interest. 

Example of flight path taken by a USAF RQ-4 drone on ISR mission (T-Intelligence/ FlightRadar24)

While FORTE10 was a daily visitor of the region even before the latest escalation, its recent activities are likely connected with Russia’s troop build-up. In the screenshot below (11 April), the RQ-4 (now FORTE 11) was orbiting over the Kherson-Mariupol area, north of Crimea, after completing multiple passes over the frontline in Donbas.

The drone’s flight path is unusual and suggests that U.S. commanders are seriously considering that Russia might open a new front in the war against Ukraine and seize the Crimean canal. 

The same RQ-4 drone (reg. no. 11-2049) using callsign FORTE 11 on 11 April while surveilling the area north of Crimea (source: @GDarkconrad)

Ukraine dammed the North Crimean Canal in 2014. As a result, the Russian-occupied Crimea lost nearly 90% of its fresh water supply, leaving it dry. While Moscow plans to solve this issue by re-routing four rivers into the Mezhgorny reservoir by 2024, many observers fear that Russia might use military action to seize the Crimean dam. 

Besides the “daily FORTE”, there various other NATO country platforms surveilling the Black Sea region.

POSEIDON IS WATCHING

Best known for its submarine-hunting capabilities, the U.S. Navy’s P-8A Poseidon Maritime Patrol Aircraft (MAP) also packs a substantial ISR capability. Using its powerful APY-10 multi-mode synthetic aperture radar, the P-8A can detect, classify and track surfaced vessels. The P-8A Poseidon surveillance system also includes the MX-20 – a modular HD imaging system with large-aperture lenses for high magnification, laser-range finding, and laser illumination. 

USN P-8A Poseidon aircraft on the second ramp at Naval Air Station Sigonella (Italy) – T-Intelligence/Maxar Technologies via Google Maps

Besides IMINT, the P-8A can exploit emission from the electromagnetic spectrum. Thanks to its ALQ-240 Electronic Support Measure (ESM) suite, the P-8 can geo-locate and classify enemy radar emitters. On top of that, the P-8 can launch drones equipped with specialized sensors to detect submarines based on fluctuations in the Earth’s magnetic field.

This sensor fusion is invaluable to keep a watch on the Russian Navy’s activity around the Crimea peninsula and Krasnodar Krai. The Poseidon becomes an ever more relevant platform as Russia recently announced that it would deploy ten warships from the Caspian Sea into the Black Sea. 

OLD TIMERS LISTENING IN: P-3C ORION AND ARIES II

The Poseidon’s predecessor platform, the P-3 Orion, is the U.S.’s other platform tasked with monitoring Russia’s build-up from an air-naval perspective. A rare occurrence, the P-3 acts as a force multiplier for the U.S. ISR efforts.

We have observed two P-3 variants operating in the area: the P-3C Orion and the EP-3E ARIES. While the Orion is an old airframe, it can still pull its weight in maritime intelligence collection and fulfil SIGINT duties. 

Photo of the ARIES II aircraft (reg. no. 161410) conducting Black Sea missions (copyright: Levery)

The other variant observed is an evolution and conversion of the Orion, known as the EP-3E ARIES II (Airborne Reconnaissance Integrated Electronic System II). Operated by a crew of 22+ specialists, ARIES II provides near real-time tactical SIGINT and full-motion video intelligence to commanders. ARIES can also intercept human communications (Communication Intelligence/ COMINT) and exploit a wide range of electronic emissions from deep within enemy territory. 

Plus, the EP-3E ARIES flight crew also brought some humor into the mix. During a flight around Crimea on 10 April, an ARIES II appeared on flight trackers with the callsign “AK47,” and claimed to be an “AirAsia” flight. 

ARIES II aircraft (callsign AK47, reg. no. 161410) from Souda Bay Naval Air Station on Black Sea mission on 12 April (T-Intelligence/ FlightRadar24)

ELECTRONIC STALKERS: RC-135W RIVET JOINT FLIGHTS

The last but not least platform active in the area is the Royal Air Force’s RC-135W Rivet Joint, operated by the 51st Squadron from RAF Waddington. The RC-135W is an Electronic Intelligence (ELINT) aircraft that can monitor radars, communications, and other signals emitted by the Russian units in Crimea. 

ELINT aircraft are particularly good at mapping out the enemy’s Electronic Order of Battle (EOB). EOB typically includes the identity, capability, operating details, and location of enemy threat emitters and their role within an integrated air defense network.

Compilation of RC-135W Rivet Joint missions near Crimea (T-Intelligence/ FlightRadar24)

RC-135W aircraft have started regularly operating in the Black Sea in late February/early March. This is likely when the first signs of Russian troop movements became apparent to the American and British intelligence community. Two RC-135W aircraft (reg. ZZ666 and ZZ664) conducted the recon runs using at least four different callsigns – RRR7227, RRR7238, RRR7239 and RRR7240. 

ISR PARTIES

Many of the aircraft listed have also operated simultaneously in the Black Sea theater. The tweet attached shows the airspace over the Black Sea on 6 April. 

An RQ-4 UAV was completing its second orbit over Severomonsk, while the RAF’s RC-135W was active near the Kerch Strait. Outbound from Sigonella, a P-8A Poseidon was on its way to join to ISR party. 

Another mentionable ISR party took place on 14 April and featured a different assembly of allied aircraft. A U.S. EP-3E Aries II from Souda Bay (reg. no. 16140) scanned Crimea’s southern coast for signals and other emissions. Further down south, a Turkish Navy ATR C-72-600 aircraft was patrolling the Black Sea’s midsection, making a rare appearance on flight trackers. The “no callsign” aircraft is the US Navy’s P-8A Poseidon (outbound from Sigonella) on its way for another mission over the Black Sea. 

14 April: Aries II SIGINT plane (USN, not USAF as shown on flight radar), C-72-600 maritime patrol aircraft (Turkish Navy), P-8A Poseidon and a RQ-4 Global Hawk drone (NATO – not pictured) are active over the Black Sea in a joint ISR mission (T-Intelligence/FlightRadar24)

One of NATO’s few independently-operated RQ-4 Global Hawks was was also active in the region. However, the drone deactivated its transponder before we had the chance to screenshot it.

PREVENTING SURPRISES

ISR platforms such as those observed on flight trackers enable commanders and decision-makers to “see and hear” what the Russian military is preparing near Ukraine. These missions are critical to ensure that NATO will not be caught by surprise should Russia mount a new sneak attack.

While Russia’s build-up is at 2014-2015 levels and poses a credible threat, there is still no clear indication that Moscow intends to launch a new offensive in Ukraine. 

T-Intelligence will continue to monitor the situation. 


by HARM

This article has been updated on 14 April to include a new image of an ISR “party” and a paragraph explaining it. 

Please follow and like us:
No Comments on NATO ISR Planes Monitor Russian Military Build-Up

Satellite Imagery shows Russian Military Staging Ground near Ukraine

Geospatial intelligence (GEOINT) shows a Russian military staging ground in Voronezh oblast. The newly discovered site has the hallmarks of a logistics node that could sustain a line of communication…

Geospatial intelligence (GEOINT) shows a Russian military staging ground in Voronezh oblast. The newly discovered site has the hallmarks of a logistics node that could sustain a line of communication to the Ukrainian border. 

A Conflict Intelligence Team (CITEAM) investigation revealed that many of the Russian military columns tracked by the OSINT community, including T-Intelligence, for the past days, have reached their destination. CITEAM’s study points to a rural location near Pogonovo training center, south of Voronezh city

Armed with this information, we pulled 3m/px satellite imagery of the site. Temporal analysis (2 April vs. 6 April) indicates a dramatic increase in vehicle activity and infrastructure on 6 April 2021. 

2 April vs. 6 April 2021: a countryside location south of Voronezh city becomes a staging ground for Russia’s recent troop build-up. (T-Intelligence)

High-resolution satellite imagery obtained by the New York Times provides a detailed look into the staging ground.    

Approximately 400 vehicles are visible on the satellite imagery. Armored personnel carriers make up the bulk of the forces amassed at the staging ground. Heavy artillery, including 2S19 Msta-S self-propelled howitzers and TOS-1 Thermobaric rocket launchers, is also present in large numbers. 

The military has also established semi-permanent living facilities such as barracks and field hospitals. With constructions visibly ongoing, the staging ground is expected to grow.

Ukraine’s Kharkiv and Samy regions are five hours away from the staging ground, significantly closer than Luhansk (under separatist/Russian control). 

If the staging ground is to support a conventional offensive in Ukraine, it will likely serve as a near-theater logistics node, facilitating the flow of assets further down the line of communication. It is possible that other, smaller nodes are already being established and serviced closer to the border.

Despite the recent findings, there is still no indication that a new Russian attack is imminent. 


by HARM

See our previous situation reports on Russia’s latest troop movements (April 2; April 7)

Please follow and like us:
No Comments on Satellite Imagery shows Russian Military Staging Ground near Ukraine

Russia’s Military Build-Up near Ukraine (II): Troops from Siberia, Snap Drills in Crimea, and More Convoys

The Russian Federation’s military build-up near Ukraine is expanding, drawing forces from the Central Military District and escalating as thousands of snap exercises take place throughout the country.  Social media…

The Russian Federation’s military build-up near Ukraine is expanding, drawing forces from the Central Military District and escalating as thousands of snap exercises take place throughout the country. 

Social media users have continued to capture scores of rail flatbeds hauling main battle tanks, infantry fighting vehicles, rocket launchers, fuel trucks, and even air defenses. 

Sequel to our initial report, here is T-Intell’s breakdown of the most noteworthy open-source information from 2-7 April 2021:


1. Probably the most noteworthy development is the deployment of units from the Central Military District (CMD) towards the Ukrainian border. Russia typically moves and parades units from the Southern Military District and Western Military District if it wants to “bear scare” Ukraine and the West. 

However, this week, Conflict Intelligence Team (CITEAM) observed BMPs, MLRS, and other vehicles moving west from Yurga and Novosibirsk (Siberia) on railways. 

Many vehicles’ license plates, which indicate the unit’s origin, have been partially covered to preserve some degree of operations security during the cross-theatre movement. 

It is unusual for CMD units to deploy so far from “home” except for strategic exercises. This development sets the recent troop build-up apart from past “bear scares.” 

2. Russia ordered all of its forces to conduct readiness inspections. According to the Russian Defense Ministry, a total of 4048 exercises of various scales will take place during April, including 812 bilateral exercises, at 101 training grounds and 520 facilities of the training and material base. Checks will take place in all military districts, and all types and branches of troops will take part in them.

One such snap exercise took place in Opuk training range, Crimean peninsula. Over 200 troops from the 810th Naval Infantry Brigade (Black Sea Fleet) simulated an operation to capture a beachhead. Ground forces assaulted enemy positions using BTR-82s armored personnel carriers and Mi-8AM and Ka-27 helicopters. 

3. Enter the battle-hardened “Pskov paratroopers.” Train markings seen in a TikTok video suggest that Russia has instructed one of its most experienced units, the 104th Guards Air Assault Regiment, to join the build-up – CITEAM has found. Based in Cheryokva and part of the 76th Guard Air Assault Division, the 104th is a unit known for having fought and sustained heavy casualties in Eastern Ukraine. The forward-positioning of this echelon adds further credibility to Russia’s build-up. 

4. Advanced air defenses spotted on flatbed railcars, ready for deployment. A video shows a Pantsir S-1 (AFIC/NATO reporting name: SA-22 Greyhound) and numerous S-300 tractor erector launchers (SA-20B Gargoyle) without their missile tubes in an unidentified railway terminal – reportedly Voronezh. This deployment was probably connected with the snap air defense exercise in the Ashuluk training range on 6 April.

Video frame collage showing Pantsir and S-300 systems

5. Russia continues to amass a diverse and increasingly credible posture. The hardware spotted on the move in the past three days include (but are not limited to): 

  • T-90 main battle tanks (moving from Makhachkala to Crimea); 
  • T-72 main battle tanks and BMP-3 infantry fight vehicles (Kropotkin train station, Krasnodar); 
  • 2S4 Tyulpan 240mm self-propelled mortar system (Krasnodar)
  • Tunguska anti-air artillery (on the move M1 highway); 
  • MT-LB armored personnel carriers (Voronezh region);
  • Towed howitzer, likely 2A65 Msta-B (Klintsy, Bryansk region);
  • 2S23 self-propelled artillery, 
  • TOS-1 thermobaric rocket launchers (Voronezh region).

6. Despite multiple social media claims, large-scale fighting has not reignited in Donbas. However, there has been a spike in ceasefire violations. The OSCE Special Monitoring Mission (SSM) recorded 1,424 ceasefire violations in the Donetsk region between 2-5 April. In the previous reporting period (2-3 April), the mission recorded 594 ceasefire violations. In Luhansk, the SMM recorded 126 ceasefire violations, a slight decrease from the 427 violations noticed in the previous reporting cycle. 

Visualisation of ceasefire violations in Eastern Ukraine © OSCE SSM

In addition, the SSM also noted the disappearance of seven multiple launch rocket systems (BM-21 Grad, 122mm) and five towed howitzers (2A65 Msta-B, 152mm) from a warehouse in the non-government-controlled Luhansk region on 1 April 2021. The report specifically mentions that this is the first time these heavy weapons have disappeared. 

7. The Russian-backed “Donetsk People’s Republic” (DPR) has announced military conscription for citizens born 1994 – 2003. Signed on 25 March, the DPR plans to implement the draft between 1 April 2021 and 5 July 2022. Despite the symbolic timing, DPR only expects to mobilize around 200 conscripts. Conscription campaigns are likely to continue and, in time, increase in scope.  

PRELIMINARY ASSESSMENT

What initially seemed like another annual “bear scare” – Russia’s typical postures ahead of negotiations – has now turned into a credible threat for a renewed offensive against Ukraine. This reading is based on logistical and military indicators that measure capability for an invasion, not the intention – which is political. 

Russia’s intentions remain unclear, and our confidence levels for large-scale conventional operations against Ukraine are low to moderate. We maintain our assessment that Russia aims to posture and intimidate. However, given the forces’ heightened readiness and hardware deployed, this can change at any moment. 


by HARM

special credits to @GirkinGirkin for aggregating a vast amount of media material from Russian-language accounts

Please follow and like us:
No Comments on Russia’s Military Build-Up near Ukraine (II): Troops from Siberia, Snap Drills in Crimea, and More Convoys

Russia’s Massive Troop Movements near Ukraine: Another “Bear Scare”?

Videos on social media show a massive Russian military deployment near the Ukrainian border in the past 72 hours. Main battle tanks, infantry fighting vehicles, armored personnel carriers, self-propelled artillery, rocket…

Videos on social media show a massive Russian military deployment near the Ukrainian border in the past 72 hours.

Main battle tanks, infantry fighting vehicles, armored personnel carriers, self-propelled artillery, rocket launch systems, logistics trucks, and amphibious trailers (bridge-layers) have poured into occupied Crimea, Krasnodar Krai, and Rostov oblast.

OSINT map aggregating and georeferencing videos of Russian military movements near Ukraine, as documented on social media between March 27-30 (T-Intell)

The troop movements are so big that Russian agricultural machinery manufacturers and farmers have complained to the government that they cannot move their equipment ahead of the harvest season because the military requisitioned all of the flatbed railcars. 

While the recent movements are out of the ordinary, they are not unprecedented. Russia has periodically launched large-scale snap deployments in an attempt to “bear scare” before upcoming negotiations or to test its adversaries ever since it invaded Ukraine in 2014. 

HYPOTHESES FOR THE RECENT SITUATION:

1.Tit-for-tat for Ukraine’s moderate troop surge near Donbas and Luhansk in early March (following an increased number of ceasefire violations by Russia in Donbas).

In early March, a string of videos and images surfaced on social media, reportedly showing Ukrainian military hardware, T-64 tanks, APCs, and other vehicles, moving by train towards the war-torn Donbas. 

While most of the footage remained unverified, the vast majority of the media material was genuine (not recycled from other build-ups), and a small amount could even be authenticated. For example, the images below show Ukrainian military vehicles on flatbed railcars in the Dnepropetrovsk train station. 

Geolocation of images showing Ukrainian military vehicles in Dnipro train station

The deployments followed an uptick in ceasefire violations that resulted in Ukrainian soldiers’ death and increased sightings of advanced Russian weaponry in the Donbas. 

Russia’s latest saber-rattling is likely a direct response to the presumed Ukrainian reinforcements in the east. 

2.Posturing for ceasefire negotiations.  

This is a strong candidate theory considering that talks between the Trilateral Contact Group (Ukraine, Russia, OSCE) on Ukraine to extend the ceasefire monitoring mission beyond April 1st, have nearly failed. However, the OSCE managed to extend the mandate for another year in the final hours of March 31st. 

3.Preparations for a renewed offensive against Ukraine.

The hardware type deployed and deployment locations are consistent with preparations for a multi-front assault on eastern Ukraine. Russian forces could escalate violence in Donbas while simultaneously assaulting Mariupol from Crimea to finish off the land-bridge linking Donbas with the occupied peninsula. 

Russia’s movements have certainly stirred international anxiety, and NATO seems to be taking the risk seriously. U.S. Chairman of the Joint Chief of Staff Gen. Milley had a phone call with his Russian counterpart, Gen. Gerasimov, discussing the recent troop build-up on March 31st. The U.S. European Command has reclassified Ukraine’s risk status from “possible crisis” to “potential imminent crisis.”  

There has also been a spike in aerial intelligence collection sorties off the Crimean coast. A British Electronic Intelligence (ELINT) aircraft and American drones are among the platforms that “glued their eyes” on Russia’s military manoeuvres. 

While a renewed invasion is the most impactful scenario, it is also the most unlikely at this point in time. 

PRELIMINARY ASSESSMENT

Apart from the mentioned hypotheses, there could be a myriad of other reasons that contribute to the latest actions, such as the relocation of 56th Airborne brigade from Kamyshin to Feodosia, unannounced military exercises, or extended deployments post-drills. 

The recent movements are likely just another “bear scare,” however, one should never rule out the possibility of a renewed Russian offensive in eastern Ukraine. Ultimately, this is a fluid and volatile situation that can escalate or cool down at any moment. Prudent caution is advised. 


by HARM

ALERT: Read our second part report on Russia’s build-near near Ukraine’s border, here, encompassing the latest developments between 1-7 April. 

This article is an extended version of the situation report that we shared on Facebook on 1 April 2021.

Update [2 April 2021, 1700z – CET] to include tweet of flight tracker showing P-8 Poseidon patrolling near Kerch strait.

Update [7 April 2021 1700z – CET] to include link to our second report on the issue. 

Please follow and like us:
No Comments on Russia’s Massive Troop Movements near Ukraine: Another “Bear Scare”?

Echoes of the Cold War: Why “Bears” Like the G.I.U.K. Gap

Russian military activity in the Greenland-Iceland-UK (GIUK) gap has increased exponentially in the past years. Launched from the Northern Fleet “bastion,” submarine-hunting, anti-surface, and maritime surveillance missions are at the…

Russian military activity in the Greenland-Iceland-UK (GIUK) gap has increased exponentially in the past years. Launched from the Northern Fleet “bastion,” submarine-hunting, anti-surface, and maritime surveillance missions are at the forefront of Russia’s sorties in the GIUK. These operations often come close to Norwegian, Icelandic, and British airspace, forcing NATO to scramble interceptors and shadow the visiting aircraft. With Russia’s newfound interest in the Cold War-era flashpoint, NATO is gearing up to level the playing field. 


I. RUSSIAN AIRCRAFT SHADOW NATO AIRSPACE

1.The Russian aircraft launch from air bases in the Kola Peninsula and travel south through the Barents and Norwegian Seas. During their forays, they regularly pass through NATO flight information regions (FIRs) without broadcasting their position or communicating with civil authorities. The Norwegian, Icelandic, and British FIRs have seen the most “visitors.”

Map shows OSINT observations of Russian aircraft transits through NATO areas of interests and main QRA launch points

2.Airspace around the world is divided into Flight Information Regions (FIRs). Each FIR is managed by a controlling authority, which is responsible for ensuring that air traffic is deconflicted and safe. 

SCRAMBLE, SCRAMBLE, SCRAMBLE

3.Because of the flight path, the Royal Norwegian Air Force (RNoAF) is the first to detect and respond to Russian flybys. The RNoAF regularly scrambles F-16s and, more recently, F-35A stealth fighters from Bodø and Ørland to monitor and conduct visual identification of the visiting formations. As the Russians proceed southwards, the RNoAF hands the interception duties to other NATO forces.

4.The British Royal Air Force (RAF) scramble interceptors from RAF Lossiemouth, the air base responsible for defending the UK’s northern airspace. Lossiemouth’s Eurofighter Typhoons are on Quick Reaction Alert (QRA), which means they are ready to respond to any threat, at any moment – 24/7. T-Intelligence has frequently reported on RAF’s Lossiemouth successful interceptions of Russian aircraft in the past three years.  

5.In many instances, Russian transited FIR corridors used by civilian airliners to enter and depart British airspace. In at least one situation, the British air traffic control (ATC) had to divert commercial flights to mitigate collision risk with the “incognito” Russian aerial formation. 

6.NATO aircraft serving in the Icelandic Air Policing mission (Iceland does not have an air force) have also intercepted Russian aircraft. NATO QRA aircraft have frequently encountered Tu-142 maritime patrol aircraft, Bear F and J versions, and MiG-31s. 

7.The Combined Air Operations Center (COAC) from Uedem, Germany, coordinates NATO interceptions in the GIUK. The COAC also deploys E-3 Sentry aircraft from Geilenkirchen (Germany) to provide air control and battlespace awareness. COAC-Uedem serves under the Allied Air Command (AIRCOM), which is NATO’s core headquarters responsible for air operations.

“THIS IS ̶N̶O̶T̶ A DRILL”

8.Russian aerial formations in the GIUK typically consist of Russian Aerospace Forces (RuAF) Tu-160 Blackjack bombers and Russian Navy (RuN) maritime patrol aircraft, namely Tu-142 variants. On some occasions, we noted RuAF-RuN composite formations of Blackjacks, Bear-F s (anti-submarine & maritime patrol), or Bear-Js (airframe designed to communicate with submarines). MiG-31 Foxhound interceptors have sometimes, although seldom, escorted the Bears.

Compilation: NATO QRA aircraft intercepting Russian aircraft over the GIUK (T-Intell)

9.Judging by the airframe composition, the Russians primarily conduct anti-submarine warfare (ASW) exercises in the GIUK. ASW is the art of detecting, denying, and engaging enemy submarines. Airframes like the Bear Fs can drop buoys that survey the seas for submarines. Once detected, Bear Fs can transmit the targeting data to Russian submarines via Bear-J communication relay. The kill-chain also works vice-versa, with submarines indicating the enemy positions to Bear-Js that, in turn, relay them to surface ships and aircraft. Alternatively, Bear-Fs can be armed with anti-ship missiles and anti-submarine torpedoes, being able to prosecute enemy vessels without assistance. However, the latter option is less likely as the Russian Navy, as its Soviet predecessor, emphasizes the concept of combined forces – coordinated operations among surface, subsurface and aerial assets. 

10.The presence of Blackjacks, which can carry and launch up to 12 cruise missiles, indicates that the Russians are also rehearsing anti-surface warfare (ASuW). This means that NATO bases in Norway, the UK, and Iceland and ports and vessels are on the mock-kill list. These objectives are essential for NATO’s Transatlantic sea lines of communications (SLOCs) – the strategic corridor linking North America to Europe.

11.Besides rehearsing specific mission profiles, Russian flybys in NATO flight information regions (FIRs) test the readiness, disposition, response time, and interception tactics of NATO QRA bases in the GIUK – RAF Lossiemouth (UK), Keflavik (Iceland), and Bodø and Ørland (Norway). While seemingly generic, this kind of intelligence is critical for any air force that wants to stay prepared for wartime operations.

12.To understand why the Russian military is conducting these flights – and, likely, covert sails – through the GIUK, we must examine the region’s importance to Russia’s overall naval strategy and disposition.


II.THE GIUK GAP: WHY IT MATTERS TO RUSSIA

13.The GIUK gap is a series of strategic routes between Greenland, Iceland, and the United Kingdom. The GIUK connects the North Atlantic to the Norwegian Sea and the Barents Sea – which is why it matters to Russia. 

14. From a geographical perspective, the GIUK is a two-way street. While historically the Gap has favoured the defenders of the North Atlantic, forces moving towards the Norwegian Sea must also funnel through these waterways. 

NORTHERN FLEET

15.The Barents Sea hosts the crown jewel of the Russian Navy – the Northern Fleet. Nowadays, the Northern Fleet is a flotilla in name only. In 2014, the Fleet became an autonomous command, known as Northern Fleet Joint Strategic Command. Since 31 January 2021, the Northern Fleet is a military district, the highest military-territorial division of the Russian Federation. The Northern Fleet Military District (NFMD) commands airbases, harbors, nuclear storage sites, and shipyards sprawling from the Kola Peninsula to the Arkhangelsk Oblast and Arctic archipelago. 

 

16.The importance of the NFMD stems primarily from its submarine force. More specifically, the Russian nuclear-powered ballistic missile submarines (SSBNs in the US Navy terminology), which continue to stir anxiety on both sides of the Atlantic. 

17.At the height of the Cold War, the U.S. Office of Naval Intelligence assessed that the Soviet Northern Fleet would cut NATO’s Transatlantic sea lines of communication (SLOC) in case of war. But as open-source intelligence from the CNA later found, counter-SLOC was a low-priority mission for the Soviets, or it became so in the 1980s. The introductory comments from this declassified CIA report captures the growing realization among the U.S. intelligence community that “sea denial operations in the North Atlantic are not a high priority item for the Soviet naval efforts” (Director of Central Intelligence, Stansfield Turner in 1978).

Russian SSBNs in 2021 (T-Intelligence compilation using Google Earth imagery)

WITHHOLDING STRATEGY AND BASTION DEFENSE

18.Instead of staging a battle for the Atlantic, the Soviets were primarily concerned with defending the Northern Fleet’s SSBNs. Capable of launching long-range nuclear attacks, the SSBN fleet was to be preserved as a second-strike capability following a limited nuclear exchange. This came to be known as the “withholding strategy” or the “pro-SSBN” mission.

19.To enhance SSBN survivability, the Soviets designed a multi-layered and all-domain concept known to the US intelligence community as Close Abroad Bastion (CAB), or simply “bastion.” Bastions were intended to prevent NATO submarines from infiltrating the SSBN area of operations such as the Bering Sea or the Arctic Ocean, where Soviet submarines would hide underneath the polar ice caps, and surface when needed to fire. As periodically demonstrated, Russia’s submarines are still able to surface from under the thick arctic ice.

(The video below shows a Russian submarine ice exercise that took place near Alexandra island, in the Franz Joseph archipelago on 26 March 2021).


 

20.The bastion concept called for the wholesale mining of the sea approaches, hunting enemy submarines with a combination of ASW aircraft, attack submarines, and warships, and lining up friendly shores with coastal defense batteries.  

21.The Soviets established two bastions, one in the Sea of Okotoks (Soviet Pacific Fleet) and another in the Barents Sea (Soviet Northern Fleet). In 1988, the U.S. Navy intelligence estimated that only 25% of the Northern Fleet would not have been dedicated to the pro-SSBN mission in case of war (see page 53).

RUSI Graphic shows estimated Russian bastion area in the Northern Fleet Military District

22.In response to the bastion strategy, the U.S. Navy launched a series of operations to infiltrate Soviet bastions and keep tabs on the Northern Fleet’s submarines around the clock. On 20 March 1993, an American submarine and a Russian SSBN collided off the Kola peninsula, underscoring just how easy it was for the U.S. Navy to infiltrate Russia’s bastions. The international incident forced both the U.S. and Russia to rekindle their submarine “cat-and-mouse” tactics.

23.Nowdays, the Russian Navy is no more than a shadow of its Soviet predecessor. In 1990, the Red Fleet had approximately 600 ships, of which 59 SSBNs. In 2015, the Russian Navy only operated around 170 boats – 13 of which were SSBNs. The number of SSBNs is down to 10 in 2021.

24. After decades of declining capabilities, Russia’s submarine force is now poised to grow and evolve for the first time. As part of a master plan to overhaul the Navy’s underwater capabilities, Russia is developing six submarine classes simultaneously: Borei-II (SSBN), Bolgorod (strategic), Khabarovsk (cruise missile), Yasen-M, Lada, and Improved Kilo. 

25.At the center of the Navy’s modernization program is the Poseidon weapon (AFIC/NATO Reporting name: Kanyon) – a nuclear-tipped, autonomous torpedo with unlimited range. Naval warfare expert H.I. Sutton describes Poseidon as a “second-strike doomsday weapon to literally go under missile defenses.” Alongside Bulava, a modern submarine-launched intercontinental-ballistic missile (ICBM), the Poseidon will spearhead a new generation of Continuous At-Sea Deterrence (CASD).

26.As the vast majority of these new toys will be in service with the NFMD, Russia has started paying more attention to the GIUK. Russia must closely surveil the GIUK Gap to mitigate and deny enemy infiltrations. This explains the periodic NATO interceptions of Russian maritime patrol and ASW aircraft in this area.

Technical details of Poseidon/Status-6 were likely deliberately leaked on state TV before President Putin could announce the new weapon

28.Russia also prepares to contest the GIUK in case of war. Therefore, Russia’s assertive behavior in the GIUK can be interpreted as a form of active forward-defense of the bastion concept, which inevitably entails anti-surface warfare against British, Norwegian, and American forces. 

29. Another reason for Russia to consider forward-defense in the GIUK is the threat posed by NATO stand-off weaponry. For example, a Tomahawk land-attack cruise missile can be fired from 1,600 km away (Block IV), meaning that Russian forces must intercept enemy launch platforms earlier and at a greater range. 

30.Besides its role for forward defense, the GIUK gap remains a strategic chokepoint for Russia to move warships into the North Atlantic. As outlined in its 2015 maritime strategy, the Russian Navy must ensure the “free access of the Russian fleet to the Atlantic.”

31.Russia’s interests beyond the GIUK gap stretch from overseas combat operations and joint drills to seabed warfare (attacking underwater internet cables) and intelligence collection on American submarines. 


III. NATO COUNTERMEASURES: BACK TO THE FUTURE

32.As Russia’s activities in the High North increased, the Bastion concept, the SSBN threat, and the GIUK dilemma re-emerged on NATO’s agenda. The Alliance and member states have undertaken a series of measures to curtail Russia’s revanchist designs in the GIUK gap and the Arctic.

NATO LEVEL MEASURES:

  • Establishment of a new NATO headquarters, called the Atlantic Command in Norfolk, Virginia, in 2020. The new HQ will help NATO navies from both sides of the pond better coordinate operations in the Atlantic.
  • Icelandic Air Policing (IAP) upgraded to QRA. Lacking an air force and witnessing various airspace intrusions from the Russian Air Force, Iceland requested NATO assistance in 2006. NATO established an Icelandic air policing mission in 2008. In 2014, IAP was put on Quick Reaction Alert (QRA), increasing the readiness and requirements for air policing in response to the increased Russian activity.
  • Increased integration under the Allied Air Command (AIRCOM). AIRCOM is NATO’s core headquarters responsible for air operations. Operating under AIRCOM, the Combined Air Operations Centre (CAOC) from Uedem, Germany, commands NATO’s Air Policing missions in the North on a tactical level. Thanks to COAC, multinational air policing in the GIUK gap is conducted more effectively and in an integrated matter. 
  • Increase and expansion of joint military exercise in the High North. The most notable joint drill was Trident Juncture 2018 (TRJE18), organized in Norway. Encompassing over 50,000 troops from 31 member states and partners, TRJE18 was NATO’s biggest exercise since 2002. The GIUK featured heavily on the exercise agenda. In response, Russia launched electronic attacks on Norway and Finland, jamming GPS and disturbing civilian air traffic in the High North.  

STATE-LEVEL MEASURES:

  • Budgetary increases enabled many member states to implement ambitious procurement plans that impact the GIUK region. For example, the UK is in the process of acquiring no less than nine P-8 Poseidon “submarine-hunting” aircraft. Five of which are already in service with RAF Lossiemouth. Norway (like the UK) has already purchased a bulk of F-35 stealth fighters and builds new warships and submarines. 
  • The US Navy is re-establishing the 2nd Fleet that patrolled the Atlantic Ocean in the Cold War. The 2nd Fleet was terminated in 2011 in a move to save costs. 
  • The US military has undertaken various measures to enhance its ability to respond faster to potential flashpoints in the High North. At the center of these measures is Norway, where U.S. Marines train annually for arctic warfare, and American vessels (including submarines) conduct port visits.

  • Most recently, the US Air Force has deployed B-1b bombers to Norway for the first time. Until now, most US operations in the Arctic military were staged out of the UK. In addition, the local press reported that Norway is considering leasing its naval base near Olavsvern (Norway’s far north) for use by American submarines. 

OUTLOOK

Russian flights and sails through the GIUK will persist as a form of forward-defense of its Barents Sea bastion. Russia must also maintain a foothold in the NATO-dominated waters around the UK and Iceland to secure access into the North Atlantic for peacetime and combat operations, unconventional warfare, and other objectives.

NATO’s response so far has been adequate to Russia’s resurgence. However, the Alliance must take further measures, especially strengthening ASW capabilities, to effectively counter Russia’s increasingly sophisticated submarine forces. 

The age of anti-submarine warfare in the High North is back.


by HARM

This strategic analysis was enabled by Open-Source Intelligence (OSINT). Now you can learn OSINT too! Head over to Knowmad OSINT and check out our training offer.

Please follow and like us:
No Comments on Echoes of the Cold War: Why “Bears” Like the G.I.U.K. Gap

Russian Pipe-Layer Resumes Work on Nord Stream 2

The Russian-flagged “Fortuna” pipe-laying vessel has resumed work on the controversial “Nord Stream 2” pipeline on January 24. AIS trackers show Fortuna anchored 27 km south of Bornholm island (Denmark),…

The Russian-flagged “Fortuna” pipe-laying vessel has resumed work on the controversial “Nord Stream 2” pipeline on January 24. AIS trackers show Fortuna anchored 27 km south of Bornholm island (Denmark), where gaps remain in the 94%-completed pipeline. 

Overview of Fortuna’s location

Owned by “KVT-RUS,” a Russian company, Fortuna has been recently sanctioned by the U.S. Department of Treasury over its involvement in the Nord Stream 2 project. Any company that does business with Fortuna or its owner, whether a port that provides servicing or an insurer, risks losing access to the U.S. financial system

Thanks to Sentinel-1’s synthetic aperture radar, we can see the ship formation through cloud cover and confirm Fortuna’s location. Dated January 24, the low-res imagery shows Fortuna positioned for pipe-laying operations and assisted by tugs, and other support vessels. 

Sentinel-1 SAR shows Fortuna initiating pipe-laying operations

Fortuna left the German port of Rostock after Danish authorities cleared further constructions on Nord Stream 2 on January 15. Berlin has also greenlighted work on the pipeline in German waters. 

UNSTOPPABLE

It seems that the Nord Stream 2 will go ahead despite bipartisan U.S. sanctions, criticism from Eastern European states, and even a recent resolution passed by the European Parliament that urges Brussels to halt the project. While opposition to the project grew in Germany following Navalny’s poisoning and arrest, Chancellor Merkel remains steadfast.  

The German state of Mecklenburg-Vorpomman even plans to establish an “expandable” foundation to shield the companies involved in Nord Stream 2. The German foundation “for environmental protection” will absorb the heat of U.S. sanctions such as freezing assets, as it does not have commercial plans beyond the pipeline. As a result, the real stakeholders will be unharmed – at least in theory. This operation’s success will largely depend on the Biden administration’s willingness to sanction Germany over Nord Stream 2. 

KEY BACKGROUND

What is Nord Stream 2?

Nord Stream 2 is a submarine pipeline that will carry natural gas from Siberia to a terminal on Germany’s Baltic sea coast. Russian energy giant Gazprom owns 50% of the pipeline. Royal Dutch Shell, Uniper SE, Engie SA, and Wintershall AG hold the rest. Nord Stream 2 is 1,200 km long and will double the throughput of Nord Stream 1.  

Nord Stream 2 map (source: Gazprom)

Why did work on Nord Stream 2 stop?

U.S. sanctions temporarily froze the Nord Stream 2 pipeline. In December 2019, the Swiss company “Allseas” suspended pipe-laying operations after it came in the crosshairs of U.S. departments of State and Treasury. Since then, the Nord Stream 2 consortium has scrambled to devise countermeasures against U.S. sanctions, and searched for a new pipe-laying vessel. 

The consortium contracted Fortuna and the Gazprom-owned Akademik Cherskiy” to complete the job. T-Intelligence wrote about Akademik Cherskiy’s entrance into the Baltic Sea in March 2020, after a nine-month voyage from Russia’s far east. The pipe-layer is currently docked in Wismar, Germany. 

Why is Nord Stream 2 a problem?

  • The project strengthens Russia’s grip on European energy. Nord Stream 2 goes against NATO’s and the European Union’s energy security policies that call for diversifying suppliers so that 30 or 27 nations are not at the mercy of one supplier. As the dominant force on Europe’s energy market, Russia has a long history of using gas exports as a tool of coercion. Gas is also a significant component of the Kremlin’s broader “hybrid warfare” strategy that aims to expand its influence using means other than military. 
  • It undermines Transatlantic unity. A highly divisive topic, Nord Stream 2 exacerbated existing rifts between the U.S (supported by Eastern European states) and NATO’s European core, led by Germany. 
  • It weakens Eastern Europe. Nord Stream 2 will reduce Russia’s dependence on Ukraine and Poland to transport gas into Europe. This could open up eastern Europe to more strong-arm tactics, including further aggression against Ukraine. 

by IRT

Please follow and like us:
No Comments on Russian Pipe-Layer Resumes Work on Nord Stream 2

Attack on Vienna: 9 Minutes of Terror (SOCMINT)

On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the…

On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the attacker approximately nine minutes after the shooting started. 

Hours before the attack, the gunman pledged allegiance to ISIS and terrorist leader Abu Ibrahim al-Hashimi al-Qurashi in an Instagram post. Like in similar cases, this enabled ISIS to take credit for the attack. 

THE GUNMAN

Austrian Police identified the gunman as Kujtim Fejzulai (KF), a 20-year old Austrian. He had Albanian roots and held both Austrian and Macedonian citizenships. 

KF was known to the Austrian Office for the Protection of the Constitution and Counterterrorism since 2018 when he attempted to travel to Syria to join ISIS. Turkish intelligence apprehended FK before he could cross the border and extradited him to Austria. FK was sentenced to 22 months in jail on terrorism charges but was paroled eight months later.  

In July 2020, KF traveled to neighboring Slovakia to buy ammunition for a Kalashnikov AK-47 assault rifle. He nevertheless returned empty-handed as he did not have a gun license. The Slovak police say they informed their Austrian colleagues immediately, which the Austrian Interior Ministry corroborates. 

Despite the tip-off from the Slovaks, the Austrians failed to exploit the intelligence and arrest the attacker. KF went free, attended radical mosques, and eventually procured weapons. FK also met with known foreign Islamists last summer – two from Germany who were under surveillance and two from Switzerland who have been arrested. 

THE OBJECTIVE

Neither the timing nor the target area was a coincidence. KF launched the attack four hours before new coronavirus restrictions came into effect. As the Viennese enjoyed a last night out, bars and restaurants were packed. 

The attack started near a Jewish Cultural Center on Seitenstettengasse, which was initially considered the gunman’s target. It became clear later that KF’s aim was broader. Thanks to Social Media footage and openly available mapping services, we can partially recreate the attacker’s path. 

THE ATTACK

1. Aprox. 20:00 hours (CET), Seitenstettengasse, 48°12’42.2″N 16°22’28.5″E

Tactical overview 1: Vienna gunman begins his rampage

CCTV footage from the Jewish Cultural Center shows Fejzulai, armed with an AK-47, wearing a white robe and a ski mask, running down Seitenstettengasse. At approximately 20:00 CET, KF guns down his first victim in front of Meinz Cocktail Bar. 

 2. Aprox. 20:05, Schwedenplatz tram station, 48°12’43.5″N 16°22’33.8″E

Tactical overview 2: Gunfight between terrorist and police officers

The attacker appears again on social media. An eyewitness recorded a gunfight between the Austrian police and the terrorist at the Schwedenplatz tram station. The fire exchange resulted in the injury of one officer. The eyewitness filmed the gunfight from the 1st floor of the McDonalds across the street.

3. Aprox. 20:07, Stephandsom Strasse, 48.212196’’N, 16.375128’’E

Tactical overview 3: Gunman flees location of gunfight

An eyewitness video shows the gunman fleeing the gunfight scene via Stephandsom Strasse. KF passes in front of a Billa supermarket and a theatre before taking a left turn toward St. Ruprecht church, where he is ultimately gunned down by the police. 

4. Aprox. 20:09, St. Rupert’s Church, 48°12’43.6″N 16°22’28.6″E

Tactical overview 4: Tango down

The Austrian police guns down KF near St. Rupert’s Church. A photo shared on Twitter shows the suspect laid flat on the cobblestone.  

HUNT FOR SECONDARIES?

Initial reports indicated there were multiple active shooters. Social media photos show the arrest of several suspects. 

Austrian policemen arrest several suspects in connection with the ongoing security situation on 2 November 2020

Over the next few days, the Austrian authorities continued the hunt for potential accomplices through airborne patrols and follow-up raids. At least two helicopters were spotted on flight trackers, displaying behavior consistent with aerial surveillance.

Callsign “FLYCOM2,” operated by a private airborne monitoring company, surveilled the southern city of Graz and the Slovenian border. This sortie was very likely connected with follow-up counter-terrorist activities.  

Callsign “FLYCOM2” flying in a holding pattern over Graz before returning back to Slovenia (ADS-B Exchange screenshot)

The second helicopter flew with no identity and crossed into Slovakian airspace. The helicopter loitered over Bratislava before it returned to the Vienna metropolitan area. While we cannot tell with certainty who was operating the aircraft or what equipment it was carrying on board (SIGINT, IMINT), it is highly likely that this was also a follow-up counter-terror operation. 

“Anonymous” helicopter flies over Vienna after completing a sorties in Slovak airspace (ADS-B Exchange screenshot)

Austrian police also analyzed an estimated 20,000 video materials from eyewitnesses of the attacks, searched over 18 properties, and detained 14 persons believed to be connected with the gunman. 

Despite these efforts, the police have been unable to conclusively determine whether the gunman had any accomplices. 

THE AFTERMATH

KF’s attack marks the return of mass shootings in Europe after a period of relative calm. The Vienna shooting follows a series of terrorist attacks that have shaken France in recent weeks. 

There is reason to believe that ISIS might attempt to capitalize on the recent tempo and order or coordinate a new attack. However, given the group’s precarious situation in Syria and Iraq, it is unlikely that the “central leadership” will produce more than propaganda and calls to action to incite followers abroad. 

SITE Intelligence Group reports that ISIS propaganda has already launched a social media offensive earlier this month. Pro-ISIS media is inciting lone-wolf attacks against the West, with emphasis on Madrid and Paris

Another important lesson to draw from this attack is that no country, not even neutral ones like Austria that refrain from foreign intervention, are safe from jihadi terrorism.


T-Intelligence congratulates the Austrian security forces for enlisting the crowds’ help in the blitz chase for the shooter. At the height of the attack, the Viennese Police asked social media users to send images and videos related to the attack. User-generated content of the shooter posted on social media, proved to be valuable Open-Source Intelligence (OSINT) for live situational awareness, trial evidence, and forensics data.

Learn more about OSINT here.  


by HARM

Please follow and like us:
No Comments on Attack on Vienna: 9 Minutes of Terror (SOCMINT)

Russia moves Troops to border with Belarus

Russian military intervention in Belarus is increasingly likely. Open-source intelligence shows significant military activity in Russia’s western military district. Eyewitnesses have documented at least three unmarked convoys of the Russian…

Russian military intervention in Belarus is increasingly likely. Open-source intelligence shows significant military activity in Russia’s western military district. Eyewitnesses have documented at least three unmarked convoys of the Russian Military Guard (RosGuard) consisting of transport vehicles and logistics trucks moving towards the border with Belarus on 16-17 August 2020. A CITEAM assessment indicates that the convoys could move approximately 600 people. 

Established on President Putin’s orders in 2016, the RosGuard is a militarized institution of the Russian Interior Ministry tasked with territorial defense, securing critical infrastructure, counter-terrorism, and “protecting public order.” 

So far, we have NOT noticed any Russian military assets operating in Belarus. However, the situation could change dramatically at any movement as pro-democracy protests continue to grow at an unprecedented scale. A crowd of over 200,000 demonstrated in Minsk over the weekend against Belorussian autocratic leader Lukashenko, and workers across the country have gone on strike.

Lukashenko branded the freedom movement as being a foreign-backed “colored revolution” and falsely claimed that NATO is preparing to invade Belarus. To back-up his conspiracy, Lukashenko ordered the army to hold a series of snap exercises near the Polish and Lithuanian borders between 17 and 21 August. Photos on social media show that the Belarusian forces are moving several Tochka-U short-range ballistic missile systems from Minsk towards the west, an alarming development for NATO. 

Unable to quell the protests, Lukashenko opened “Pandora’s box” by requesting security and military assistance from Russia on 15 August. After a second phone call on Sunday, Lukashenko claimed that Putin promised him “comprehensive security assistance.”

A Russian military intervention in Belarus will likely result in the de facto annexation of the country. Moscow has always feared that a “colored revolution” will transform its neighbor into an adversary. If Belarus slips from the Kremlin’s orbit, Russia will lose access to the Suwalki Gap, the strategic corridor linking the Baltic states to the rest of NATO, and the gargantuan Baranovichi airbase.
In the past months, Moscow has been insistently pressuring Lukashenko to bring Belarus into a new federal union with Russia. While “Europe’s last dictator” wants to keep the country under his thumb, given the new circumstances he will likely prefer to forfeit Belarus to Russia than be ousted by the population.


This report was originally published on our Facebook page on 17 August 2020.

Please follow and like us:
No Comments on Russia moves Troops to border with Belarus

NATO Special Operators Among First Responders at Kabul Maternity Ward Attack

American and possibly British, Norwegian, and Australian special operations forces (SOF) were part of the reaction force that responded to the maternity ward attack in Kabul (Afghanistan) on 12 May…

American and possibly British, Norwegian, and Australian special operations forces (SOF) were part of the reaction force that responded to the maternity ward attack in Kabul (Afghanistan) on 12 May 2020, according to Social Media Intelligence (SOCMINT). In the early hours of Tuesday, unidentified gunmen disguised as police officers stormed the Barchi National Hospital in Kabul. The attackers killed 24 people, including medical personnel, patients, and even two newborn babies. 



THE TIER ONE COUNTER-FORCE

In the SOF counterattack that ensued, the foreign and Afghan operators of the Crisis Response Unit (CRU) 222 managed to rescue 100 women and children, including three foreigners.

SOFs regularly operate without national identification and wear masks to conceal their identity for operation security (OPSEC) reasons and to preserve political deniability. Yet, there are still plenty of elements that can help identify a SOF group’s nationality, such as uniform camouflage patterns, gear, weapons, accessories, and other equipment pieces. 

Twitter users with knowledge of tactical equipment have recognized the country and units of the SOFs deployed on-site. As the tweets below show, one of the first special mission units identified is the Combat Applications Group(CAG) or 1st Special Forces Operational Detachment-Delta (SFOD-D), which is more commonly known as “Delta Force.” Specializing in counter-terrorism, hostage rescue, and counter-proliferation, Delta is among the most secretive and lethal American SOF groups.

Twitter users recognized the American SOFs by their distinctive night-vision goggles (NVGs), custom pistol stock, pouch, and holster.  Social media speculations also place British SOFs, likely the Special Air Service (SAS) alongside Delta in one of the photos.

The Norwegian Forsvarets Spesialkommando (FSK) is another foreign SOF group recognized by Twitter users. While less known than its anglophone counterparts, the FSK is one of the most experienced NATO special mission units. Besides Afghanistan, they also operated, and are probably still active in Syria and Iraq.  

As Twitter users pointed out, at least one Australian SOF was also present during the counter-terrorist raid. If indeed from the land down below, the operator was likely part of the Special Air Service Regiment (SASR), Australia’s equivalent of the British SAS. Australia is one of NATO’s closest strategic partners. Australian SOFs have seen extensive service alongside their Euro-Atlantic allies in the Global War on Terror.  

RESOLUTE SUPPORT MISSION 

Regardless of their exact unit or nationality, it is virtually certain that foreign SOFs played a significant role in neutralizing the terrorist threat in Kabul. Without them and their Afghan counterparts, the death toll would have been dramatically higher. 

The foreign SOFs are in Afghanistan as part of their respective national military deployments. Their objective is to conduct counter-terrorism missions and train, advise, and assist the Afghan National Army and Security Forces (ANASF). 

RSM Commands via NATO

Following the end of major combat operations, NATO initiated the Resolute Support Mission at the invitation of the Afghan government in 2015. RSM is a capacity-building operation and consists of 39 NATO and non-NATO participating states. RSM advisors train the Afghan National Army (ANA) and Air Force (ANAF) so that Kabul can defend itself after the end of NATO’s military mandate. The RSM also helped the ANA build its first-ever SOF component, including the Crisis Response Unit 222, that spearheaded the response to the maternity attack. 

Afghan CRU 222 operators via Recoilweb.com

Apart from the RSM, the U.S. SOFs are also engaged in Operation “Freedom’s Sentinel,” an overseas contingency counter-terrorism mission against ISIS’s regional franchise, the “Islamic State-Khorasan” (IS-K).

IS-K LIKELY BEHIND THE ATTACK

While the horrific attack is still unclaimed, “Islamic State-Khorasan” (IS-K) is the likely culprit. The Dashti Barchi Hospital sits in a predominantly Shia neighborhood – an area that IS-K has also attacked in the past. 

Afghan intelligence has captured the IS-K commander and two of his aides in Kabul, just a day before the attack. The senior operatives were likely in Kabul to oversee the execution of the mission. 

Another circumstantial piece of evidence linking the massacre to IS-K was a second attack on 12 May 2020. A suicide bomber killed at least 32 people at a funeral in Nangarhar province. While Afghanistan experiences sporadic countrywide violence daily, the funeral and hospital attacks may be connected. 



Shiite communities are IS-K’s main targets apart from political institutions, according to our assessment from 2019, which you can find here. The attack is consistent with IS-K’s strict interpretation of Sunni Islam, militant Salafism, which views Shiites and other Muslim sects as heretics. IS-K uses sectarian and takfiri violence to mobilize hardcore Salafists/ Deobandi and establish an Islamic State in South Asia, encompassing Afghanistan, Pakistan, and the Kashmir region. 

IS-K has refrained from taking credit for its attacks in the past. In this case, the unclaimed attack on the maternity ward likely aimed at sabotaging the Afghan-Taliban peace process. By not claiming the attack, IS-K wanted to cast suspicion on the Taliban. IS-K has no interest in seeing a reduction of violence in Afghanistan. IS-K consists of disenfranchised Pakistani Taliban, splinter groups from the Islamic Movement of Uzbekistan (IMU), and a few foreign fighters. The Taliban is not only IS-K’s main competitor on the extremist market but also its existential threat. 

Afghanistan conflict map as of 29 February 2020 via Al-Jazeera

The Taliban has publicly denied involvement in the attack. While many Taliban cells continue to defy the “reduction of violence” agreement with Kabul, it is unlikely that the group was involved in the maternity ward massacre. Afghan President Ghani has nevertheless ordered the Afghan military to resume offensive operations against all militant groups in Afghanistan, including the Taliban. President Ghani was likely concerned to look weak in the face of Tuesday’s bloodbath in the center of Kabul. 

The Afghan peace process remains as fragile as always. 

Please follow and like us:
No Comments on NATO Special Operators Among First Responders at Kabul Maternity Ward Attack

Type on the field below and hit Enter/Return to search